CVE-2024-13365: Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives when scanning them for malware through the checkUploadedArchive() function in all versions up to, and including, 2.149. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13365?
CVE-2024-13365 is classified as a high severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2024-13365?
To fix CVE-2024-13365, update the CleanTalk Security & Malware scan plugin to version 2.150 or later.
What versions of CleanTalk are affected by CVE-2024-13365?
CVE-2024-13365 affects all versions of CleanTalk Security & Malware scan up to and including version 2.149.
What are the risks associated with CVE-2024-13365?
The risks associated with CVE-2024-13365 include potential unauthorized file uploads and subsequent compromise of the WordPress site.
Is CVE-2024-13365 being actively exploited?
As of now, there have been reports indicating that CVE-2024-13365 may be actively exploited in the wild.